[promises] Check if receiver is smi before loading map

src/builtins/builtins-promise.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins-promise.h"
 #include "src/builtins/builtins-utils.h"
 #include "src/builtins/builtins.h"
 #include "src/code-factory.h"
 #include "src/code-stub-assembler.h"
 #include "src/promise-utils.h"
@@ skipping 993 matching lines @@
 // ES#sec-promise.prototype.catch
 // Promise.prototype.catch ( onRejected )
 TF_BUILTIN(PromiseCatch, PromiseBuiltinsAssembler) {
   // 1. Let promise be the this value.
   Node* const promise = Parameter(0);
   Node* const on_resolve = UndefinedConstant();
   Node* const on_reject = Parameter(1);
   Node* const context = Parameter(4);
 
   Label if_internalthen(this), if_customthen(this, Label::kDeferred);
+  GotoIf(TaggedIsSmi(promise), &if_customthen);
   BranchIfFastPath(context, promise, &if_internalthen, &if_customthen);
 
   Bind(&if_internalthen);
   {
     Node* const result =
         InternalPromiseThen(context, promise, on_resolve, on_reject);
     Return(result);
   }
 
   Bind(&if_customthen);
   {
     Isolate* isolate = this->isolate();
     Node* const then_str = HeapConstant(isolate->factory()->then_string());
     Callable getproperty_callable = CodeFactory::GetProperty(isolate);
     Node* const then =
         CallStub(getproperty_callable, context, promise, then_str);
     Callable call_callable = CodeFactory::Call(isolate);
     Node* const result =
         CallJS(call_callable, context, then, promise, on_resolve, on_reject);
     Return(result);
   }
 }
 
 }  // namespace internal
 }  // namespace v8